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1 tmMr,>i?c?m a 7 Feb m 

w m m 

[0002] t^i^ mmMmx-h^>^-^mm^titc^yh^-y±iimm<D^mm 

K^T^U DoS (DenialofService) Ifc^^fcfiDDoS (DistributedDenialofService) # 
Z_t£* WWXffil (#^2003-283554-^-^) l^^nfc^hy-^^TO 

mmhytyyfr&gL-tzfrm^^yy-rZo -eu-c, ^vtchy^yy^mi^tc 
tpmmwn. mm^t^m^m^y-yh^m^i-^tz^mm^^ 

mtstiz&m&m/<y-yb(Dtem&m*mm^z®!m&m 0 
[0003] ^-c% ±ffi-£tcteTffi<D*mmw:t^ mmmm*h^*mmm (wt, 

mmmt^yo )xh<>x. ^mm^<y-yh^y\-r^m^M-t^mmm 

XtbZ> B ^UC, ±^xmm^^^^it Lfctlgfli, T^w4««gd^ 

m^^^zx^xmm^^iEm^y'yh<D^mmmmm^mmT^m^ny 
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[0005] _hiEUbfc5^ ****^^h©fia^flf*ir«U 
[0006] #ff^tjStl:#W2003-283554^# 

[0007] L*»Wfc*se>, _hSBUfctSe*wSflftts '»f JKKBKiisv ^ lESv^^^iS 

[0008] *^x\ z.<D&mn* ±mvt^^m<omm^m^^r^\^^titih(Dx^ 
[0009] ±^vtzmm^nmu @ m^mm-r^tab, m&m^mzmwn. s-vr-yhom 
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[0010] m^mimzmwte, ±m(Dmw^&\, vr, m^y^^mm^m^ 
coon] ff*^3tc^BP^{i, Jbiao^jei&i^ mw^?*?-*tm^Wi\t. 

tf»^^-Wcov vc. Suffix Pg<^$Sffl#J^LV W^SiV ^fcHK#& 

[0012] ^ i»*^4{^5^B^(4, ±u<Dwm^^x, mi£cDJ$m?&mtkmm*\z. 
[0013] sa:, i**iS5(c^5igp^fi, ±m<DmwK3o^T, ffii£(DiEMgkmzm^ ^x 

[0014] ^c, lt*«6(v:#5^PJ{4. JhfEtf>£§^l;i*^-C, ^WEh^tS^ffi^ 

^^^±m^m^^x^iE^^^±^thtzm^, mmiE'str* 



4 



[0015] ifcfc, f»*JS7^55S ±IS©|SMlci*5V vf, ft Wlil^^yhSr*JIR-t-5 
[0016] £fc, tt^8^«5»WHt, JbSEfcSBWKifcv euM^^^K^^^iSU 
[0017] £fc, S»*«9»^5ISMtt* -LfEtf>388l3 t-*5V vf* ^yF^-^flf^b^ 

[ooi8] ^/c, m^ioiz&zmwte. s<*yY(Dmm:mm^ttito<n^y*^*%dm. 

o 

[0019] sfc, itsiwfii i s<*vY(Dmm:Mm^tt.}b<Dz/7*^*ffl& 
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[0020] sw^gi 21^538 wf±* JUEos&iHtefcv *t, awE^^-riait^fkwt 

[0021] «|3(e5Ci3^«S»Wtt, ±ISW|g|g(-*5V>-Cs itufBv^^-tfEti^te 

[0022] Sf *3®14»^538Wtt, /^yhwaaSHWIIili-afcfeO^^irSr^ 

ot, HuSE^^^IE1S^{-iS1t$n5V^^^{-oVNT^5feliS^Sr^-r 

^ftluS^^ >TWfa^^h^iia§^iJ^i-^^5/h©J^liii:. &ffix.tiZk$: 
[0023] Sfc, »*JSl5lc«5|8W}± N ±lBO^Sig{C*5VNT, fflrtB'^^-YlB«#e»± 

[0024] gS*3®16^«-5«Wtt, JtSEtf>3BW fc*3V N T> HUia^^^-TlEti^Sfi 
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[0025] 1*^1, 10, H*fcf4l4©|5W^«ttutf, V^^^IElft^^lSlS^^^ 
[0026] S»*3®2, 12^fc{4l5^>|gP^{-«ttL{^ atb^rit^^f-fJl^K^^ 

[0028] £fc, ffl|*JS4©|8W^J:ix«r, Jfe^^^^hO^ffifcii^LT, ^gEV^^-v 
Sr^t-5^fcSI^»K^^^®flBfeie<fc«r*^i"S©"e. ^^^^ 

So 

[0029] f»jftJ®50>S8|l3 ^ J:ttWT % ***Jft/^!/h©tft tti K&LT, jES^^-Y 

[0030] Ifcfc, «|3ft3S60»W«tLrJ, ^FiEh7t^^ffll-8RbT, ^FjE^^-r^: 
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[oo3i] ^fc, st*3S7©i8Micj:ixtf , mtD^M&m^m&^y^^gimvtcmiz. 

[0032] »*3g8K>|SM^J:tLHr> m<D*mmmfrblEm&ft$:%:iml,tzm^ 1EM 

[0033] sS*«9c^^BJ {d J; jxHT, ^ybU-^m^^>^^^ifHiftm 

[0034] [Hll]|glltt, *yM7— ^^^E^^I^^AWpJ^^-r^^Afll^cia-efcSo 

o 

[Ill8]|g|8{i,^^-r^fBf^^S^|llS^-r^n-^^— h-Cfc^o 
[|ll9]09{i % ^jE/^h^ajB#<^^S^|l|S^i-7n--^— hT**)5o 

[0035] io fmmw: 

12 Mamas 

13 #^1&ffigB 

14 ^^YM\t^ 
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15 m^mmt^m 

16 Z7^/U^ 
17 

20 

30 Iltffi* 

100 ^yhV-fVcmPiffl^*^ 

[oo36] MTimMm&*mmisX^(Dmwimz>tpM%im. fmjjm&xwmyv 

[0037] [JUfg^Sfc^] 

[0038] £fc, ^HJSM-effl V vs iJEffi*/?*^! tii. &m->v**?-^m%-tZ/<tr>yh 

[0039] £7^ ^HJS^J-effl V ^ r^IEv'^^-YJ M> ^lEh^t^^mS^IE/-^ 
{a$,^lE;<^yb(Dmim7zlPTb'i'X<g*M7£VXm&&ftZo 
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[0040] [v'^^A(D^g*5j:U ? #m] 

[0041] mm^jjk-f£oiZ^(D^yh\7— ^TO^^AlOOfi. ^yYV— ?±\zm%C 
<D*PMBm0$:WiZ-Xffij&£hZ> o ZL<D*yhV-?±.\Z.\t, DoS#S^DDo 

zm^mz^t'^—PtisXcDmrn ^30^mm^x\^ o &*5, etT-cw:* m 

■tf-w*20-2£LTK9IU ilWiS*30O^-^^|2:S'J-ram^(-«> Jiff #s*30 

- 1 ~ii«^*3o - 5tvxmw-rz> 0 

[0042] 36»d»5^yM7— ^S^S&ftJ^^lOOI^V^T, * M^SlOfi, iiffi^*30 

[0043] «£eKiO{i % &mJzMWsy3&-r(£b\ai., lEffi^y**^<D4if& 

2, W^gio-45oJ;OT^Sio-7-efe«9, t»itt»ilio-543j:tj«»f»iB3KK 



k. 
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[0044] «^glOii. *yW— ^m^hi^f ^^i^Wk^^^. ^iE 

mm^mmm^h^m^x^^^^h^m^fitz^v^-r(D^t^ m 
Wjtkfcyy^TikTzm^xmw-tZo 

[0045] i<7><}:9t~LT, tpMmWlOn, ^Ws?**^. JFlE^?**^£>MlEM.i/7" 
[0046] ^L-C, ^Hife^JtZlfc^^^eiOfi, ^^^VWZ.^m^t^b^^^ 

\z.m&mm:tt^x^z&izttz><ftmfthz>o ^ww*. ^i^gio^ /.< 

[0047] **5 % «=gBlOf± v «»BWU*i*^^h**iKi-5fcft«>a6«^*>9, 
[0048] [f*t3£tt<af*J&] 



11 



mio<Dffif&&^-r7'uy?m-e$>Zo mm^-f£?^ s ^(D<pmmmon, ^yh 

://H3c)£, v^}^-YiI{fgtfl4^ m$cM$L&:7£&l5b, 7j;V?%<>\G(Mmz. 
[0049] ^M^BlOii, CPU (CentralProcessingUnit) -^^V. ^-Kf^flr 

V 

[0050] ft*^m»i3tt«F§ ! Fa*©«sH^lB«tor^^^^^^sj , tie 

&^ftil-**J£U 7^;^16I4PD< r/^hiSlii¥Sj v-^t^-r 

[0051] ID2^*5VNT, ^yM7— ^gtfllte. *yH7— *k&ME£iiXlt*E>M 
mm^t<DfflX~s<^yh*m%:1rZ)^mX'fo'Q, Mrfctoltts LAN(LocalAreaNetwo 
rk)£fcliWAN (WideAreaNetwork) ftW^yb 1 ?— ?k&MtfZ>1tlb<D*<yh9— 9 

[0052] A;Wl7Wu ^yhv-y-^m#frb&m(Dmm^m^<DAtiz&nrtZAt)^ 
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[0053] s^yhW&UlZU. M^7i- ^SPll^fSU^t/^yhSrl&Wb, 

[0054] 5Jr^m^l3ii, /^yhSl#|flS12^«toT^^tbfc^H-m#l-S<5VVT, # 

[0055] I§i3tt, ^^^^m^#^-y/H3a^|Elt$tL5if «L J:"J3¥*WJ-tt, Slf ^ 

[0056] ^^^ffi^#©r^mJ114jJ-fi.M^{^,iP^^ht-^ti'SiP^^ 

<D«tea«*gJ&*;»t3„ AflcW^li, I33K:*3VvC, K04$ffiMt£{±, r 

DestinationlPAddress (2a:5fcIPTKl^) J T 192. 168. 1. 1/32 J (dst=192. 168. 1.1 

/32) „ \P(D±.{tLm (TCP^fcteUDP) OyfuY^/VWiMtt^ Protocol 
J^rTCPjT?fet)(Protocol=TCP)^^o N IP^i^g^nh^/^^cOT^^— >a 
>-^it#T^5^^^i-rDestinationPort(^^c>t?— J fl« r80j-C£>5 (Port=80 

[0057] ^fc, #-^-201^^— KltffiMttfi^ /DestinationlPAddress (^Q^felPTK^^) J & r 1 
92.168.1.2/32j-C£>'9(dst=192.168.1.2/32h £>o % r Protocol (:7°nfrvl/) j^FljDP 
(UserDatagramprotocol) J-Cfc5(Protocol=UDP)^V^JStt'fiiL^*a"C^^tt5 0 P 
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fflZs &-%3(DU=i— K«HHJRttHt, rDestinationlPAddress(^IPTKl^^)j^ri9 
2.168. 1.0/24jfcV^*H4-e»3t*H5. 
[0058] ?j[»^tftffi^#»rtftfflHiitj{i % KT»^*xSttfflJM*«r#o3fc 

3£Ufet>©^*)5o ft*3, H3»Jltt^UTV^V^, ^ffiJRtttC*5V^Tfi, TDestinati 
onIPAddress(^B3feIPTK^)j^fif?T^#(any)iU IPOJb^S07°nh 
^^HSU^^"* - fProtocol h=vt") J dCMP (InternetControlMessage Protocol) 

[0059] H4tt, TSE^tS^tftm*^^— ^H3b^|5lt^tL5lf J^PIfflfai, # 

[0060] ftteWWi* #-§-l©^iEh7ty^*#tt, r^^FWlKbps^_b, sVryh&S 

IEh7fcy^fe#f4s r^i^^F^T2Kbpsl^Ji, ICMPdnternetControlMessageProto 
col) _h0?^3— ^ (EchoReply) *jrfc— ^^^^h^S2#a±»^^f £;fc/Cl % 

*f?J£T3Kbps£t_h, x-^^S^r^fc^^^ht^^S^-^ii^IP^^ 
[0061] |H5f3\ iE^fe^T 1 — 7*/H3c^gElS$ix5ttf#s «tt)t^«Biwtt % jES^Jffi*^ 
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[0062] ^ffcfftlCte, ^%\<D^— K^tfetfURttte* IP©rSourceIPAddress(3H£5cIPT 
YUX) j^ri72.16.10.0/24j-C^r^m^L(src=172.16.10.0/24) , #-8-2?>t^ 
— K^tfcfflJRttttlPJbW— t^ppft£^1~ TTypeofService (■#— fc^-TT 0 ) J tf* T 
(16^T*)01jT*fc5~t£^UTV^(TOS=0x01) o CWj^friE^MWi, #R 

[0063] 02<^|ft^^M^, ^S^ffimStt, /^h5l#|fP12^«toTS^tbfcgtfh 
[0064] £fc, ?fe*|fcmaS13te, ^^ffibfc^t^ *J^^*^*«rfefc:jESS^ 

5(oM&m\<^Tmw-rzbs m3^n^Wr^-i<Du^— K^M^T^m^^-^ 

hOS&v'^^-Hi* [dst=192.168.1.1/32,Protocol=TCP,Port=80]t^>9, H)5^jo 
V^T N IFjJv^^-Wi, [src=172.16.10.24,dst=192.168.1.1/32,Protocol=TCP,Port 
=80]*5j:U ; [TOS=0x01,dst=192. 168.1. l/32,Protocol=TCP,Port=80]^^^ o 
[0065] ££>(d N Jfc*^tt}^13«, 04^bfc^FiEh7ty^^#^>V^^^^— ^(d 
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[0066] ±mvx^tc^mmnim3{z^x^.^ti±mm^^^, jem^?*^ 

[0067] |H2^*5V MT, ~>^^-riHf g|U4ht, &m$itilUl3fc$iJ&l,t">y*?-vm$: 
[0068] ^5feHI^^15(i, &ft^Zi/7*^Vxhl6a\Z&mTfr>y*?- J r(>'y 

[0069] E6^ffl^T. v^^^y^MSa^lftB^i-So IH6{i, ^^-vlWl6a 

i-t%^kfrX£Z> 0 

[0070] ^u-c, mm^-tx^ *mMM^&\,^x, mftm&ikizmsi*, smm^ 
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[0071] ^3fe«H^^l5Ji, fliRtf, 06{^U^^^-yE*5J;^>^^^F 

[0072] ^fc, ff 5fe«s(&*^i5i4, m-(Dm^^h^mwn<D^^^ mm. m 

[0073] roJ;?^ jfe«Hft*3tasi5»±, ^^^©«BU^iWR«r«4*fca6<5v N "C, 
*^£v-^*^y*hl6a{c:3£«k-r;5„ 

[0074] IH2{vl*5V^T, 7-f^|BJ16tt, *yM7— ^^7*— XgfllldS^fgUb'-^S'h 
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[0075] ^bT, ^^§P16«, AtltStitc/<frybt>K ffi^l^oTJiRfvi^UhV vf 

t-A^-rs, -£fztemm-tz>t£t\ mm^tz.^^^<D^m^m^^x^yb<D 

fcUTV^c^^fi, 7^^161*, ^y*^^Cfcm^^X/<tryb$:ffilE<D*~ 

[0076] rr-^r, *=L—^\,^xmW-fZ>t, 7-<^gPl6{4, ^lEi/i?^^m%-fZ>s< 

;<frybttm ^lHxc^^^^^U£V v^Mi, JEM*-—? m<DlEM 
ov NXii, ^mm^Um^-T^yh^—^y^y^—^mi l/^W^U 

[0077] te%>, ^y-**^v*bi6a^&m£ntc^y**^<DW:mmfem 
[0078] v^m^m^yb^mco^m 
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hXh& 0 

[0079] i^m^-r^t-. *wmmo<DymtkfoUizu, mz\^vtz&&^mkm& 

[0080] Affci&fm. ^:felifimfc>£m5{2, W^v'^^^J;«9^iE^.e/^5 : -to^^ 

[0081] mftm&tkiEmsn. m^mitL^^t^^m-r^^^j^hi 

6a£ffr£U ffr&Ucv^W >M V 1 6 zfe-7j?\s$U 1 6 ^gprT 5 (^^S4) D 

-Cttu ^^>^^^*5j;t>*iE^#)^i¥^^^«{-^f (^^S5) 0 
[0082] [^^^s-ffHt^&ys] 

[0083] I^ISKi^t-ipt-, «^mo<7>>^^iijfgfli4#k ^4>«g^)^^f 
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[0084] m9cvm^m5\-±. ^^^mmm^^mvtimm^^^ 
Wkf&r* (^^sis) „ c^t\ m%m&(Dtkttm%. ±mvtc^mmm^ 

[oo85] ^<d&, m%m{±L$:7Em5n. m^cMiiL^^tz^^m-r^^^v^bi 

-y'7'S15) 0 
[0086] C^iE^s/M&ftB^&kS] 

[0087] [SJBM^-t-J:?^ ff^BlO^^ttlglilSfi. 04^Lfc^IEh7t5/^ 

3{Z£^X±f&£ftttJEisy*^Z$:tfAftX, i^V^^(D^9c)mm:^-r 
S(^^S23) 0 

[0088] JMfclfttm, «Mgte^m5f3, |!E^^>^^l;xM6a^C^^^^TV^§gS 

^mmi3iz^x^^tc^iE^^^<Dm%mi^^m-r^ 0 £e>^ ^ie 
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[0089] mftmrntTZMisyz. ^m^^b^m^-r^^^y^M 

o 

[0090] [|U£#rJ<D£bjjl] 

[0091] ^fc, Jbia^HifeM^Jin^ gib^^^^J:^^^^^^^^^^ 

[0092] £fc, _hfE(7?»^J^J;n^. /^h(Diiai^R)f^(D^|S-e$iJPS-r5fc>6^i5: 

[0093] Ml<£>lli£#J] 

[0094] {Sttf, _Lf2tf>0lifeM-efi, r^^v-^^-r j J: 9t> tiEM^?*^] ct?;^^ 



c 
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[0095] _h|50HifeMT'l±, #^*fcffiB#K r&Jfc*>^*^j fc^-f Z<D m 

o 

[0096] _b^HJS^J-Cia^bfc#^g(^J^{^, Ull \Z.M7FVtitpMBWlO) (D& 

Mmwioizxfttefrfrz&mmmifen. ^^^fciiffiic^— cpu^j; 
vt^mcpuizxffiffimft£nz>-7v?yj±izxmm£th. *>sv>f* % y^—vw 

'y?iz£Z>^~-b°<?^T£VXmm£tinZo 
[0097] ±^<DmMMXmWVtc&® : m<Dolb. J^1b^l\ZLis^t>Mh(OtVX^ 

- [0098] ^\±|5(7)|liSM-C(i,^^Srll^-r5#^B(MxL^ tfrttKKlCti&Ht 
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HhayytJ^j^ti^ ^-Kf-f^^, 7i<^?ss7/isf>(X*(FD) . CD-ROM, mo 
tt«, ^^Jt^Lfci^^^^M^n^ASr^UfcCD-ROMSrSa^Tb, 

[0099] £JUk&J:5K:, #$§03K#5**&I£B* *j»*fc*5J:OT »^n^^afeW-^y 

^&h^xh¥ftm(Dmpfx/<^vY*m&irz>^t\tm-rz> 0 



23 



-r (dov vr, BuiE^ijps^ia^bv nv-^^-v^^sv ^m^mu^H-^-r^ 
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&$Lf$.tstbtzm&^ mmiEM.i/y*^^mffln&*n^xffimisy* : ?-\m 
^hv-^nm-h^^^^nmxxti^^^^Aii^^^ 
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mm~>y**^mw.^& ^mm^n^^^-^^ ^xm^cmi^ikm-t^m 

mmmftm&fcfcj^mzj:^x®:7££thfzLmftm$L<Dmi< *ju^ m^y^^\ 
w^m^v**^\*mm^. m mm^nt->y'^^m^xmm^ 
yb(Dmm*m'm-tz>;<^yhmmjint, 

tZW;-f-Z>i><DXhoX, 

mmm%.Mi±L&:7£T.m^ mm^^^mw:^ ^tmtsfczmm^y**^ 

-rteiov vt\ w-mWR(omm^mL^ ^y^^-\(0^\zM\ ^5feliR{u^#-^i-5w 

t^wt-rumm v&zm 2\z.^m<D *mjj& 0 
jjfe*^t°~—?izmn^z*m7vy*7-i*x$>^x, 
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o 

mm<Di/f*^-Y$:mig--tz>h<Dxfo^x, 

ti-ov vr , ffimmm<7)mmi>mv\, ^r&f-wisK&fr ^ftmu&tt-^-rz^ 
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[1*13] 



CH14] 



1 3a im®mtk&gt{ ! $T- 7n 










1 


Pst=192.168.1.1/32,Protocol=TCP,Port=80} 


500Kbps 


10fj> 


2 


pst=1 92.1 68.1. 2/32,ProtOCOl=UDP> 


300Kbps 


10# 


3 


{Dst=192.168.1.1/24} 


1000Kbps 


20# 










1 3b ^ie s ^ b v m^te&T - 7)v 
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T1 KbpsJ^±0>/ \7r «v h #Slf£J.;*±^&&fE;**iTU & 


2 


T2Kbps!il±(Z>ICMP/Echo Reply/t^ >y K *< 
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T3Kb p s&L±CD T7 ^ V * > h / >y K # 
S3f<m±^&{§£ tlT U 3 







[HI5] 



i3c mum *t 
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{Src=172.16.10.0/24> 
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{TOS=0x01> 







[ID6] 



16a U^h 
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v 0 * 3- -v 
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1 






♦ TIEv^'T^i' 
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X-1 








X 




X+1 








Y-1 








Y 




Y+ 1 
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Z-1 
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i/^f + E 


Z+1 









[07] 



( START ^ 
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giiv^ft • mM->7*T* Ls4 
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( START ^ 



MS'*'*** -jEgUfcttfcSfll J~ S1 1 



J— S12 



J_S13 



7/7 



[H9] 

-J 



( START ^ 



J-S21 



J-S22 



J— S23 



